National Threat Assessment Center Releases First-of-Its-Kind Report on Mass Attacks

A new multi-year analysis from the Secret Service illustrates the link between the internet and public violence.

We may earn a commission from links on this page.
Photo of police outside Tops grocery store
On May 15, 2022, a shooter open fired in a Tops grocery store in Buffalo. Before killing 10 people and injuring three others, he posted about his intentions online via Discord.
Photo: Joshua Bessex (AP)

A white supremacist killed 10 people and injured three others in a Buffalo, New York supermarket in May 2022. While the gunman was carrying out his heinous act of violence, he was also livestreaming the shooting on Twitch. For months leading up to the attack, the shooter posted about his plans on Discord. The 19-year old shooter telegraphed his intentions on the internet, and in that—he’s not alone.

Most perpetrators of mass, public attacks were active online prior to carrying out their plans, and almost a quarter conveyed concerning messages on the internet hinting at their violent intentions, according to a first of its kind report from the Secret Services’ National Threat Assessment Center.


The analysis, published this month, assessed 173 attacks in public spaces that took place between January 2016 and December 2020. In all of the attacks, at least three people were harmed, making them “mass” acts of violence by the Department of Homeland Security’s definition. In total, 513 people were killed and 1,234 additional people were injured in these attacks.

NATC’s report compiled and analyzed information on the motivations and behaviors of all of the attackers, as well as the circumstances leading up to their violent acts. The assessment reveals trends about mass attacks in America.


For instance, almost three-quarters of all of the attacks analyzed were carried out with a gun. In 68% of the attacks, perpetrators targeted random victims, not particular individuals. Yet in those “random” cases, the attacker was still often targeting specific groups or categories of people (i.e. victims of a particular race, religion, or gender). Personal, workplace, or domestic grievances motivated 51% of the attacks according to the report. While the second most common motivation was ideological, with the perpetrator espousing extreme or hate based views in one-fifth of all incidents.

50 of the attackers (28%) had demonstrated an interest in military, law enforcement, or similar careers, and 31 (17%) had actually served in the military, as a police officer, or a security guard. The percentage of military, police, or security-associated attackers was higher than the portion who the NATC reported experienced psychosis.


The report also demonstrates the internet’s role in mass violence. Through statistics and case studies, the NATC report documents the online activities of attackers and catalogues a trend of internet warning signs. Over two-thirds of the attackers engaged in prior threatening or concerning communications, and lots of that communication happened on online.

On an internet forum dedicated to the discussion of school shootings, one poster outlined imminent plans to kill his father and then attack a nearby school. The day after threatening the violence, he carried it out. Another perpetrator posted a photo of a gun on social media minutes before initiating a shooting. Yet another still spent more than year engaged in an extremist imageboard before he carried out an act of violence that he claimed was motivated by a hatred of Jewish people. The list goes on.


“Online platforms may be utilized by individuals to make violent communications and to share violent rhetoric and ideas,” the report authors wrote. The internet can also be a place where attackers are enabled, emboldened, molded, and/or begin to act out.

In six cases, the attacker was known to have acquired their weapon(s) online—either by directly buying a gun or purchasing parts. NATC also identified six perpetrators as having become “radicalized in their beliefs through online engagement.” Misogynistic beliefs and behaviors were common among the attackers, and 8% engaged in such behaviors online like posting “revenge porn” or threatening women on the internet.


It’s a disturbing parade of stats, but one that could theoretically be used to inform violence prevention. One of the most unifying features of mass attacks is that people surrounding the future perpetrators notice something is wrong before the violence occurs. In 76% of all cases, the attackers’ behavior leading up to the incident elicited concern from their family, friends, community, or strangers. In nearly half of all cases, that concern came from peripheral contacts, like peers from online communities. If those concerns were broadcast to others, taken seriously, and handled with care, perhaps future acts of violence could be stopped.

“Everyone has a role to play in prevention,” Lina Alathari, chief of the NATC, said to NPR. “It’s not just one person’s responsibility or one organization’s responsibility. It is a community-wide, multi-disciplinary effort.”